Negotiable instrument electronic clearance systems and methods

ABSTRACT

Methods, devices, and systems for analyzing negotiated negotiable instruments for unlawful activity are described. A computer system, including a computer readable storage device and a processor may be provided. A plurality of electronic files may be received. Each of these electronic files of the plurality of electronic files may include an electronic image of at least a portion of a negotiable instrument and include a plurality of data fields. The plurality of electronic files may be divided into subsets based on whether data is available in particular data fields of the electronic files. Based upon the subset an electronic file is made a member of, various selection criteria may be applied to determine if the electronic file is a candidate for suspicious and/or illegal activity. Also, a listing of candidates for suspicious and/or illegal activity may be presented to a user.

CROSS-REFERENCES

This application is a continuation of U.S. patent application Ser. No.12/557,719, filed Sep. 11, 2009, entitled “NEGOTIABLE INSTRUMENTELECTRONIC CLEARANCE SYSTEMS AND METHODS,” which is hereby incorporatedby reference in its entirety for all purposes.

BACKGROUND OF THE INVENTION

Historically, the clearing of negotiable instruments, such as checks andmoney orders, has been a paper intensive process. For example, acustomer may enter a financial institution, such as his bank, andpresent a negotiable instrument for a particular monetary value to becashed or deposited. The bank or financial institution, referred to asthe “bank of first deposit,” may then present the customer with themonetary value of the negotiable instrument. In many instances, the bankor other financial institution that issued the negotiable instrument,referred to as the “issuing bank,” is not the same as the bank of firstdeposit. Therefore, the bank of first deposit that has cashed ordeposited the negotiable instrument must collect the appropriatemonetary value from the issuing bank.

Typically, this would involve the bank of first deposit sending thenegotiable instrument to their clearinghouse (alternatively referred toas their check processor). This clearinghouse may then route thenegotiable instrument to second clearinghouse associated with theissuing bank. This second clearinghouse may process and verify thenegotiable instrument. Thereafter, the clearinghouse may transmit orsend funds to the bank of first deposit for the value of the negotiableinstrument. Considering that banks and financial institutions must dealwith cashing or depositing huge volumes of negotiable instruments on adaily basis, including negotiable instruments received from issuinginstitutions throughout the country and world, handling negotiableinstruments is an expensive, time-consuming, and cumbersome process.Some banks or financial institutions may even go so far as to charterprivate airplanes to deliver negotiable instruments to the appropriateclearinghouse or check processor.

As may be expected, a percentage of transactions using negotiableinstruments involve illegal, suspicious, or illicit activities. Theseillegal, suspicious, or illicit activities may include money laundering,such as funding for drug trafficking or terrorist activities. In someinstances, banks and financial institutions may be under a legalobligation to investigate and/or report suspicious activity to anappropriate government agency. The problem of money laundering may beparticularly pronounced when dealing with money orders.

A personal check may typically include certain information, such as thepayor's identity, the bank account the funds are being withdrawn from,and the recipient's identity. Depending on the monetary value of themoney order, not all of this information may be present or collected byeither the issuing financial institution or the bank of first depositfor a money order. For example, the recipient's identity, the source ofthe funds, or the payor's identity may not be present on the moneyorder. Therefore, it may be more difficult to determine if thenegotiable instrument is being used for money laundering or otherillicit or illegal activities.

In helping to prevent money laundering or other illegal or illicitactivities, the delivery of negotiable instruments to the clearinghouseor check processor associated with the issuing financial institution maybe considered to have certain advantages. For example, receiving thephysical negotiable instrument allowed for certain characteristics ofthe physical negotiable instrument to be categorized, reviewed, and/orinvestigated. The negotiable instruments, that had been cashed ordeposited and subsequently returned to the issuing financial institution(or the clearinghouse associated with the issuing bank), could be sortedaccording to varying criteria.

However, the process of physically moving paper negotiable instrumentsis being replaced by electronic negotiable instrument processing, or, inother words, the transmission of an electronic image of a negotiatedinstrument with associated data fields from the bank of first deposit(or its associated clearinghouse) to the issuing bank (or associatedclearinghouse) as opposed to the physical negotiable instrument. In suchan electronic processing scheme, the physical negotiable instrument maybe destroyed once an associated image has been created. The methods toexamine or investigate properties or aspects of the negotiableinstrument may be changed in order to detect suspicious, illegal, and/orillicit activities in an electronic processing environment.

The following invention addresses this and other problems.

BRIEF SUMMARY OF THE INVENTION

Devices, systems, and methods are described for a novel architecture ofnegotiable instrument processing and/or analysis.

The analyzing and/or processing of negotiable instruments for illegalactivity has previously been applied to physical negotiable instruments.However, under the Check Clearing for the 21st Century Act, negotiableinstruments are increasingly being converted to an electronic format forprocessing and/or clearing due to, among other reasons, potentialsavings in processing time and cost. When an electronic file, such as aX9.37 format file, containing an image of a negotiable instrument isreceived at an issuing financial institution or at an issuing financialinstitution's clearinghouse, the electronic file may be evaluatedaccording to various criteria. These criteria may classify theelectronic files based on factors such as: a minimum or maximum monetaryvalue of the imaged negotiable instrument contained within eachelectronic file, a deposit account number at the bank of first depositthe negotiable instrument was deposited into, a sequence numberassociated with the bank of first deposit (meaning, the order in which anegotiable instrument within an electronic file was deposited at thebank of first deposit), a sequence associated with the ECE (ElectronicCheck Exchange) institution, and/or a sequence associated with theendorsing bank's sequence number. Therefore, certain preferred factorsmay be used to evaluate electronic files of negotiable instruments ifpresent, and other factors may be used if the preferred factors are notavailable. Based on these factors and other selection criteria,electronic files containing negotiable instruments may be analyzed todetermine which electronic files, or groups of electronic filescontaining negotiable instruments should be further investigated forsuspicious and/or illegal activity.

In some embodiments, a method for analyzing negotiated negotiableinstruments for unlawful activity is described. A computer system,including a computer readable storage device and a processor may beprovided. The method may include receiving, at the computer system, aplurality of electronic files. Each of these electronic files of theplurality of electronic files may include an electronic image of atleast a portion of a negotiable instrument and include a plurality ofdata fields. The method may further include, storing at the computerreadable storage device, the plurality of electronic files. The methodmay also include identifying a first subset of the plurality ofelectronic files. This identification may include an identifier beingpresent in the same first data field. The method may also includepreventing the first subset of the plurality of electronic files frombeing identified as part of another subset of the plurality ofelectronic files. The method may also include identifying a secondsubset of the plurality of electronic files. The electronic files of thesecond subset may have a second identifier present in the same seconddata field. The method further includes applying a first set ofselection criteria to the first subset, to identify suspiciouscandidates from among the first set for unlawful activity, and applyinga second set of selection criteria to the second subset to identifyadditional suspicious candidates from among the second subset forunlawful activity. Finally, the method may include displaying thesuspicious candidates for unlawful activity to a user via a computersystem.

In some embodiments, the negotiable instrument is a money order. In someembodiments, the negotiable instrument is a check. In some embodimentsthe method may further include grouping electronic files by originationdata. This origination data may be a return location routing number. Insome embodiments, the electronic files are in X9.37 format. In someembodiments, the first data field is configured to contain a depositaccount number at the bank of first deposit. The second data field maybe configured to contain a bank of first deposit sequence number. Insome embodiments, the method also includes identifying electronic filesfrom the plurality of electronic files below a minimum thresholdmonetary value and isolating the electronic files below the minimumthreshold value from being added to a subgroup.

In some embodiments, a third subset is selected from among the secondsubset of the plurality of electronic files. The members of the thirdsubset are in sequential order according to the bank of first depositsequence number. The method may also include reordering members of thethird subset according to the bank of first deposit item sequencenumber. The reordering includes electronic files containing negotiableinstruments with the monetary value below the minimum threshold monetaryvalue. The method may also include selecting a fourth subset from thereordered third subset. The fourth subset may include sequentialelectronic files according to the bank of first deposit item sequencenumber and electronic files having a greater monetary value than theminimum threshold monetary value.

In some embodiments, a method for analyzing electronic images ofnegotiable instruments for money laundering is described. The method mayinclude providing a computer system, including a computer readablestorage device and a processor. The method may also include receiving aplurality of electronic files. Each of the electronic files of theplurality of electronic files may include an electronic image of anegotiable instrument. Each electronic file of the plurality ofelectronic files may also include a plurality of data fields. Eachnegotiable instrument may also have a monetary value. The method mayalso include identifying a first group of electronic files that eachcontain a negotiable instrument that exceeds the threshold monetaryvalue. The method may include sorting electronic files of the firstgroup of electronic files into a plurality of subgroups. Each electronicfile of the first group of electronic files may be only sorted into onesubgroup. Further, the method may include identifying candidates forfurther analysis from each subgroup of electronic files according toselection criteria. The selection criteria applied to each subgroup maybe different from the selection criteria applied to each other subgroup.The method may also include providing to a user a listing of thecandidates for further analysis.

In some embodiments, the selection criteria applied to the firstsubgroup is based on a total monetary amount of monetary value depositedin a particular deposit account. In some embodiments, storing the firstgroup of electronic files into the plurality of subgroups includesdetermining whether each electronic file is a member of a first subgroupprior to determining whether each electronic file is a member of asecond subgroup. In some embodiments, the method includes a thirdsubgroup that contains electronic files that were not sorted into anyother subgroup, thereby functioning as an overflow subgroup.

In some embodiments, a method for analyzing images of negotiableinstruments for money laundering may be present. The method may includeproviding a computer system, the computer system including a computerreadable storage device and a processor. The method may also includereceiving a plurality of X9.37 electronic files. Each X9.37 electronicfile of the plurality of electronic files includes an electronic imageof a negotiable instrument, a plurality of data fields. Each negotiableinstrument within each X9.37 electronic file has an associated monetaryvalue. The method may also include storing the plurality of X9.37electronic files. The method may also include sorting the plurality ofelectronic files based on a monetary value threshold of each negotiableinstrument within each X9.37 electronic file. The method furtherincludes creating a first group comprised of electronic files thatcontain images of negotiable instruments greater than the monetary valuethreshold. The method also includes storing the first group ofelectronic files into subgroups. A first subgroup may be identified byan identifier being present in a “deposit account number at bank offirst deposit” data field. A second subgroup may be identified by anidentifier being present in a “bank of first deposit item sequencenumber” data field. Electronic files may be members of only onesubgroup. The method also includes creating a candidate group for eachsubgroup according to selection criteria. The first subgroup is sortedaccording to a total monetary value of negotiable instruments containinga same identifier being present in the “deposit account number at bankof first deposit” data fields to create a first candidate group. Themethod also includes creating a listing of members of the firstcandidate group.

BRIEF DESCRIPTION OF THE DRAWINGS

A further understanding of the nature and advantages of the presentinvention may be realized by reference to the following drawings. In theappended figures, similar components or features may have the samereference label. Further, various components of the same type may bedistinguished by following the reference label by a second label thatdistinguishes among the similar components.

FIG. 1 is a simplified block diagram of an embodiment of a system forthe use and processing of negotiable instruments.

FIG. 2 is a simplified block diagram of an embodiment of a system forreviewing and/or analyzing negotiable instruments.

FIG. 3 is a simplified block diagram of an embodiment of a method forreviewing and/or analyzing negotiable instruments.

FIG. 4 is a simplified block diagram of another embodiment of a methodfor reviewing and/or analyzing negotiable instruments.

FIG. 5 is a simplified block diagram of an embodiment of a method forreviewing and/or analyzing a subgroup of negotiable instruments.

DETAILED DESCRIPTION OF THE INVENTION

Devices, systems, and methods are described for the implementation of anovel form of clearing, analyzing, and processing electronic negotiableinstruments. Such clearing, analyzing, and processing of electronicnegotiable instruments may be used to detect suspicious activityregarding the use of individual or groups of negotiable instruments.While such analyzing and processing may be applied to any negotiableinstruments, such as personal checks, certified checks, bank checks,etc., such analyzing and processing may be especially useful whenapplied to money orders, due to a possible decreased amount ofinformation gathered regarding the payor (the person sending money) andthe payee (the person receiving money). In X9.37 format electronicfiles, a format commonly used for electronic transmission of negotiableinstruments, an image of a negotiable instrument and various data fieldsmay be present. However, it is not required that each of these datafields contain information. In other words, some of the data fields arerequired to be completed by financial institutions and some areoptional. Therefore, while one bank of first deposit or clearinghousemay specify the account that a negotiable instrument is deposited into,another may not provide this information. Therefore, flexibility inanalyzing negotiable instruments for illegal or suspicious activity maybe necessary.

When an electronic file, such as a X9.37 format file, containing animage of a negotiable instrument is received at an issuing financialinstitution or at an issuing financial institution's clearinghouse, theelectronic file may be evaluated according to various criteria. Thesecriteria may classify the electronic files based on factors such as: aminimum or maximum monetary value of the imaged negotiable instrumentcontained within each electronic file, a deposit account number at thebank of first deposit the negotiable instrument was deposited into, asequence number associated with the bank of first deposit (meaning, theorder in which a negotiable instrument within an electronic file wasdeposited at the bank of first deposit), a sequence associated with theECE (Electronic Check Exchange) institution, and/or a sequenceassociated with the endorsing bank sequence number. Not all of thesefactors may be able to be evaluated for each electronic file due tomissing data (such as, due to incomplete optional data fields).Therefore, certain preferred factors may be used to evaluate electronicfiles of negotiable instruments if present, and other factors may beused if the preferred factors are not available. For example, inclassifying an electronic file, if the electronic file contains theaccount number at the bank of first deposit the negotiable instrumentwas deposited into, the evaluation process may not consider the bank offirst deposit item sequence number, or any other factor in classifyingthe electronic file.

One goal of this process, considering the large volumes of negotiableinstruments (perhaps in the millions) that individual banks andfinancial institutions must process and/or clear on a daily basis, is toaccurately identify negotiable instruments or groups of negotiableinstruments that exhibit characteristics consistent with illegal orsuspicious activities quickly and accurately. Further, the amount of“false positives” may wish to be minimized, thereby decreasing thenumber of electronic files mistakenly believed to involve suspiciousactivity.

Currently, many issuing financial institutions may be in the process ofconverting from systems that involve the physical delivery of cashednegotiable instruments from the bank of first deposit back to theissuing financial institution, to systems that include only the deliveryof an electronic file (commonly a file in X9.37 format) containing animage of the negotiable instrument, along with various data fields thatcontain mandatory and optional information regarding the negotiableinstrument and the processing of the negotiable instrument from the bankof first deposit to the issuing financial institution, or its associatedclearinghouse. The conversion to electronic processing of negotiableinstruments may be seen as being made possible by the Check Clearing forthe 21st Century Act, colloquially referred to as the Check 21 Act. Thislaw allows for the recipient of a paper check or other negotiableinstrument, such as a money order, to create a digital version of theoriginal negotiable instrument, thereby removing the need forpreservation of the physical negotiable instrument.

The processing and transmission of negotiable instruments as electronicfiles have many obvious benefits, such as the speed of transmission, theease of transmission, and the cost of transmission. However, at leastfrom the standpoint of analysis for illegal or illicit activities, theremay be several drawbacks to electronic processing of negotiableinstruments. Consider the following example, provided for illustrationpurposes only: A drug trafficker is receiving a large payment for hisshipment of “goods.” In an attempt to avoid detection, the drugtrafficker receives his payment anonymously using money orders. Hisbuyer, as payment, sends him a dozen money orders each for thousands ofdollars. The drug trafficker, along with several of his cohorts, go to alocal bank, approach a teller, and have her cash the money orders.

At the bank, these may appear to be normal transactions. However, alater analysis by the issuing financial institution or the clearinghouseassociated with the issuing financial institution when the cashed moneyorder is returned for clearing may prove otherwise. For example, fromthe time of the money order being cashed by the drug trafficker and hiscohorts, to the time the issuing financial institution or theclearinghouse associated with the issuing financial institution clearsthe cashed money orders, the money orders may remain approximatelygrouped if they all attended the same bank to cash the money orders.Based upon an analysis of this order as received by the issuing bank orthe issuing bank's clearinghouse, it may be able to be determined thatthis group of transactions has a probability of involving illegal orillicit activities. For example, the negotiable instruments may beexamined to find groups of sequentially processed negotiable instrumentsthat, in total, were cashed for more than $5,000. Following this, theissuing financial institution may notify, as required by law, theappropriate government agency, and/or refuse to fund the associatednegotiable instruments.

However, such an analysis may yield many false positives because groupsof negotiable instruments from multiple banks of first deposit are beingprocessed following each other. Therefore, it is possible to have groupsof sequential money orders total over $5,000, but were cashed at banksof first deposit with no relation to each other (indicating a lack ofsuspicious activity), such as located thousands of miles apart.Processing and/or analyzing electronic files of negotiable instrumentsmay help to decrease false positives such as these.

In addition to information such as the order the negotiable instrumentwas received in the teller's till, other information that may be usedfor analyzing a physical negotiable instrument for clearing may not beavailable if the physical negotiable instrument is not returned to theissuing bank or the issuing bank's clearinghouse. Therefore, in order tocomply with government regulations, identifying a high percentage ofillegal or suspicious transactions involving negotiable instruments, andminimizing the number of false positives (that is, transactions that arelegitimate, but were initially determines to be suspicious) new and/ormodified processing and/or analyzing may be conducted by issuingfinancial institutions to clear and/or analyze negotiable instruments.

FIG. 1 is a simplified block diagram of a system 100 for the use,processing, and clearing of a negotiable instrument, such as a check ora money order. While the following description refers to a money order,one with skill in the art will recognize that any negotiable instrumentmay be used. Initially, payor 120 may determine that he wishes to givepayee 130 a sum of money. Payor 120 may use a check, such as a personalcheck, a bank check, or certified check. However, payor 120 may not knowor wish to divulge all of the information necessary to create one ofthese forms of checks to be issued to payee 130. Further, payor 120 maynot know or wish to disclose the name of payee 130. Payor 120 may decideto have a negotiable instrument for the amount he wishes to pay payee130 created. Instead, payor 120 may have a money order created. Such amoney order may not require any information, or only limitedinformation, to be divulged about the payee 130 or payor 120.

If payor 120 decides to send payee 130 a money order, she may contact anissuing financial institution that issues money orders. In FIG. 1,issuing financial institution 110-1 issues money orders. Payor 120 mayobtain the money order for the amount he desires by physically going toa branch or agent of issuing financial institution 110-1, using anInternet-based system run by issuing financial institution 110-1, usinga phone-based system to interact with issuing financial institution110-1, or any other system that enables communication between payor 120and issuing financial institution 110-1 or an agent of financialinstitution 110-1. At the time of acquiring the money order, payor 120may be required to provide funds in the amount of the negotiableinstrument to issuing financial institution 110-1. In some instances,payor 120 will provide funds additional to the amount of the negotiatedinstrument as a fee for the issuing financial institution 110-1 issuingthe money order.

Upon receiving the money order from issuing financial institution 110-1,payor 120 may deliver the money order to payee 130 by any physicalmeans, such as in person, by mail, or by courier. Upon receiving themoney order from payor 120, payee 130 may retain the money order for aperiod of time. After a time, payee 130 may bring the money order to abank or other financial institution to be cashed or deposited, referredto collectively as a “bank of first deposit” 140-1. Payee 130 may or maynot have an account at bank of first deposit 140-1. In some instances,bank of first deposit 140-1 may not even offer accounts, such as a checkcashing establishment that charges a fee for cashing a check, moneyorder, or other negotiable instrument. Upon presenting the money orderto bank of first deposit 140-1, depending on certain conditions, bank offirst deposit 140-1 may collect information on payee 130.

For example, if the monetary amount of the money order is greater than acertain threshold amount, bank of first deposit 140-1 may require payee130 to identify himself, provide a driver's license, or some otheridentifying document. In other instances, payee 130 may not be requiredto provide any information to bank of first deposit 140-1. Bank of firstdeposit 140-1 may inspect the money order for authenticity or any signsof tampering. At this point, the money order has not cleared, howeverbank of first deposit 140-1 may provide the associated funds to payee130 based upon an expectation that the money order will clear. Forexample, if the money order is drawn on an issuing financial institutionthat is known to be financially solvent and reliable, such as WESTERNUNION, bank of first deposit 140-1 may provide the funds to payee 130immediately, with the expectation that the issuing financial institution110-1 will provide the funds associated with the money order.

At this point, bank of first deposit 140-1 may have physical possessionof the money order. Every so often, such as once a day, bank of firstdeposit 140-1 may forward all of the negotiable instruments, includingthe money order, it has received to a clearinghouse (also referred to asa check processor). This clearinghouse 150 may handle all negotiableinstruments for bank of first deposit 140-1, including multiple branchesof bank of first deposit 140-1. Further, clearinghouse 150 may handlenegotiable instruments for other banks that function as banks of firstdeposit. For clarity, only one additional bank, bank of first deposit140-2, is depicted in FIG. 1, however any number is possible. Also,clearinghouse 150 may be part of bank of first deposit 140-1, or may bean independent business entity functioning separately from bank of firstdeposit 140-1.

Clearinghouse 150 may then process the money order. This may includedetermining where to route the money order based on a routing numberprinted on the money order, typically an ABA routing number. Thisrouting number may be machine-readable, such as written with magneticink. This may also include clearinghouse 150 imaging the money order,and converting it to an electronic file. Clearinghouse 150, aftercreating the electronic file containing the image of the money order,may destroy the physical money order, such that only the electronic filecontaining the image of the money order remains. The electronic file themoney order is converted into may be in X9.37 format. The electronicfile in X9.37 format may contain or be configured to contain standarddata fields that are present in all X9.37 files. In some embodiments,X9.100 format files are also used. As those with skill in the art willrecognize, any mention of X9.37 format files in this application may besubstituted with X9.100 format files.

Clearinghouse 150 may encode the electronic file of the money order withadditional information. For example, this additional information may beassociated with some or all of the data fields present in the X9.37file. Entry of data into these data fields may be mandatory or optional,depending on the particular data field. This data may includeinformation such as: the deposit account number at the bank of firstdeposit 140-1, the bank of first deposit item sequence number (that is,a number indicating the order in which the money order was received bythe bank of first deposit), the ECE (electronic check exchange)institution item sequence number, the endorsing bank sequence number,etc. In some instances, later institutions holding the X9.37 file mayadd additional information to data fields within the electronic file.Based upon the routing number or other information on the money order,clearinghouse 150 may route the electronic file containing the image ofthe money order to the appropriate clearinghouse associated with issuingfinancial institution 110-1. Therefore, clearinghouse 150 may interactwith many other clearinghouses throughout the country and/or world. Therouting from clearinghouse 150 to clearinghouse 160 may be via acomputer-based network, such as the Internet, or some other public orprivate electronic network.

Clearinghouse 160 may be part of issuing financial institution 110-1, ormay be independent from issuing financial institution 110-1. Also,clearinghouse 160 may function on the behalf of other financialinstitutions, such as issuing financial institution 110-2. For clarity,only one additional financial institution 110-2 is illustrated in FIG.1, however any number of additional financial institutions may interactwith clearinghouse 160. Upon receiving the electronic file of the moneyorder from clearinghouse 150, clearinghouse 160 may route the moneyorder to issuing financial institution 110-1 or may process it on behalfof issuing financial institution 110-1. Processing the money order mayinclude verifying that the money order was in fact issued by issuingfinancial institution 110-1, verifying that the amount the money orderwas cashed for at a bank of first deposit 140-1 was the same amount thatthe money order was issued for by issuing financial institution 110-1,and/or that the money order appears not to be involved in any illegal,illicit, or suspicious activities. Worth noting, all the actionsperformed by clearinghouse 160 may be performed by issuing financialinstitution 110-1. Further, clearinghouse 160 and clearinghouse 150 maybe the same clearinghouse.

Within clearinghouse 160, there may be additional detail as to how moneyorders, checks, and other negotiable instruments are handled. FIG. 2illustrates a simplified block diagram of an embodiment of system 200for reviewing and analyzing negotiable instruments. Clearinghouse 220 ofFIG. 2 may be clearinghouse 160 of FIG. 1, or may be some otherclearinghouse. Clearinghouse 220 may have several components including,server 230, user computer 260, and storage 240. Server 230 may receiveelectronic files in X9.37 format from multiple external sources 210.These external sources may be other clearinghouses, such asclearinghouse 150 in FIG. 1, or other banks or financial institutionssuch as bank of first deposit 140-1 in FIG. 1. External sources 210,also referred to as settlement points, may send electronic files toserver 230 in periodic batch transfers or in real-time as they arereceived by external sources 210. Individual external sources ofexternal sources 210 may send electronic files to server 230 atdifferent times throughout the day and/or week.

Upon receipt of the electronic files at server 230 from external sources210, the electronic files may be processed immediately or stored for anamount of time prior to processing. Therefore, until processing andanalysis, the electronic files may be stored at storage 240. Storage 240may be any appropriate form of a computer readable storage medium, suchas a hard drive, a tape drive, memory, etc.

Server 230 may have access to a set of criteria 250. These criteria maybe stored on storage 240. These rules may define how various electronicfiles received from external sources 210 are processed, analyzed, and/orpresented to a user. Server 230 may also interact with the usercomputer. Such a user computer 260 may be any form of computer capableof interacting with server 230 and user 270. User computer 260 may serveas a way for a user 270 to interact with the electronic files andcriteria 250. Therefore, using user computer 260, user 270 may be ableto adjust criteria 250 to vary how different electronic files areprocessed and/or analyzed. For example, if while processing andanalyzing an electronic file, server 230 encounters an unexpectedcondition or occurrence or has detected suspicious activity, usercomputer 260 may display the questionable electronic file or group ofelectronic and associated information to user 270. Further, user 270,using user computer 260 may be able to control when server 230 processesand/or analyzes the electronic files for clearing.

Also, server 230 may have the ability to interact with an external lawenforcement system 280. Upon determining that an electronic file orgroup of electronic files may have been involved in illegal or illicitactivities, server 230 may forward the files to and/or alert lawenforcement system 280. In some embodiments, prior to contacting lawenforcement 280, server 230 presents the suspicious electronic files orgroup of electronic files to user 270 via user computer 260. Also,contact with law enforcement system 280 may be via a user computer 260,instead of server 230 as depicted in FIG. 2. In some embodiments, user270 must personally contact law enforcement.

In determining whether to alert user 270 or law enforcement system 280,server 230 must process and/or analyze the electronic files according toa set of instructions or criteria 250. FIG. 3 provides a simplifiedblock diagram of a possible embodiment of a processing and/or analyzingmethod employed by server 230. Process 300 may be used by server 230 ofFIG. 2 or may be used by some other computer or server system toprocess, or analyze negotiable instruments for illegal activity. Atblock 310, electronic files are received. These electronic files mayhave been received from sources such as an external sources 210 of FIG.2, or may be received from some other source. In some embodiments, atblock 315, electronic files are grouped or sorted according to athreshold monetary value. In other words, electronic files containing anegotiable instrument at or above a threshold monetary value are sortedinto one group, while those below the threshold monetary value aresorted into another group. This threshold monetary value may bepredetermined and/or set by a user to any monetary value. Of course, thehigher the threshold monetary value, the fewer negotiable instrumentsthat may be expected to greater than the threshold monetary value.

At block 320, electronic files that were greater than the thresholdmonetary value evaluated at block 315, may be grouped according to theirreturn location routing number. This returned location routing number isa value present in one of the data fields of X9.37 electronic files.

Following the electronic files being grouped by a returned locationrouting number at block 315, the electronic files may be evaluatedand/or analyzed to determine which subgroup each electronic file shouldbe a member of. Some electronic files may contain more data than others,due to some X9.37 data fields being optional. For example, not all datafields contained in an X9.37 electronic file will contain data.Therefore, while examining and/or analyzing electronic files based onparticular data fields contained in an X9.37 file, information may notalways be available in particular data fields. It may be necessary toset up a hierarchy of information or data to examine various data fieldswithin the electronic files for varying data. These subgroups aredefined such that each electronic file may only be a member of onesubgroup. Therefore, in other words, for each electronic file, a firstsubgroup is examined, if the electronic file does not meet thequalifications for this subgroup, it is determined whether theelectronic file qualifies for a second subgroup, and so on. Process 300illustrates one possible embodiment of a hierarchy involving multiplesubgroups.

First, the electronic files grouped at block 320 are evaluated at block325 to determine if they should be made members of a first subgroup. Ifthe answer is yes, the electronic files may be added to the firstsubgroup at block 340-1. The determination of whether an electronic fileis a member of the first subgroup may be done according to criteriadefined by a user. In most instances, the criteria used to make thedecision as to whether an electronic file is a member of the firstsubgroup will be the criteria that most clearly identifies whether anegotiable instrument in an electronic file or negotiable instruments ina group of electronic files exhibit suspicious characteristics.

If an electronic file evaluated at block 325 is not qualified to be amember of the first subgroup (e.g., it does not have an identifier inthe deposit account number at bank of first deposit field), theelectronic file is evaluated to determine whether it is a member of thesecond subgroup at block 330. Therefore, electronic files that aremembers of the first subgroup may not be evaluated at block 330. Thecriteria to be a member of the second subgroup may be different than thecriteria to be a member of the first subgroup. In some instances, thecriteria or set of criteria, used to determine whether an electronicfile is a member of the second subgroup is the criteria that mostclearly, besides the criteria of block 325, identifies whether anegotiable instrument in an electronic file or negotiable instruments inthe group of electronic files exhibit suspicious characteristics. If anelectronic file qualifies to be a member of the second subgroup, it maybe added to the second subgroup at block 340-2.

If an electronic file evaluated at block 330 is not qualified to be amember of the first or second subgroup, it is evaluated to determinewhether it is a member of the third subgroup at block 335. Therefore,electronic files that are members of the first or second subgroup maynot be evaluated at block 335. At block 340-3, these electronic filesare made members of the third subgroup.

If an electronic file is not a member of the third group evaluated atblock 335, the electronic file may become a member of a fourth subgroupat block 340-4. Therefore, the fourth subgroup may contain all of theelectronic files that did not qualify to be a member of the firstsubgroup, the second subgroup, or the third subgroup. As those withskill in the art will recognize, there may be greater or fewer than foursubgroups, and greater or fewer than three evaluation steps.

At this point, each electronic file that is a member of the group ofelectronic files above a threshold monetary value evaluated at block 315has been made a member of a subgroup. Additional evaluation of eachelectronic file may now be performed on each subgroup to further narrowthe field of electronic files to be investigated for suspiciousactivity. Various selection criteria may be applied to each subgroup.The various selection criteria applied to each subgroup may be differentor may be the same as the selection criteria apply to other subgroups.At block 345-1, the members of the first subgroup are analyzed with afirst set of selection criteria. This set of selection criteria may lookat each electronic file separately, or may look at groups of electronicfiles together.

Such further investigation may occur at block 350-1. Block 350-1 mayinclude generating a listing of all the electronic files that met thefirst set of selection criteria. This may include individual electronicfiles being listed and/or groups of related electronic files beinglisted. Therefore, not every member of the first subgroup may be listedas a candidate electronic file for suspicious activity at block 350-1.

At block 345-2, each electronic file of the second subgroup is analyzedaccording to a second set of selection criteria. This second set ofselection criteria may be the same selection criteria as the firstselection criteria, or may be a different set of selection criteria.Based upon an analysis according to this second set of selectioncriteria, an electronic file or group of electronic files may warrantfurther investigation. These electronic files that warrant furtherinvestigation may be listed at block 350-2. The listing generated atblock 350-2 may be added to the listing of candidate electronic filesproduced at block 350-1. In some embodiments, the listing of candidateelectronic files produced at block 350-1 is maintained separate from thelisting of candidate electronic files produced at block 350-2.

As in the first subgroup and the second subgroup, a similar analysisaccording to a third set of selection criteria is performed on the thirdsubgroup at block 345-3. Again, the third set of selection criteria maybe the same as the first and/or the second set of selection criteria ormay be different. At block 350-3 a listing of candidate electronic filesanalyzed according to the third set of selection criteria is created.This listing may be separate or combined with the listings produced atblock 350-1 and 350-2.

There may or may not be a fourth selection criteria at block 345-4 toevaluate the fourth subgroup. As subgroup four includes all of theelectronic files that did not qualify to be in the first subgroup, thesecond subgroup, or the third subgroup, it may not be possible to createa selection criteria capable of isolating electronic files that haveevidence of suspicious activity from those that do not. This may resultin every member of the fourth subgroup being added to a listing ofcandidate electronic files for suspicious activity at block 350-4.Alternatively, because such limited information regarding the members ofthe fourth subgroup may be available, none of the members of the fourthsubgroup may be added to a listing of candidate electronic files atblock 350-4.

Each of the listings generated at blocks 350-1, 350-2, 350-3 and 350-4may be displayed to a user, maintained in a storage file for laterinvestigation, and/or forwarded to law enforcement. Each of theselistings may be combined into a master listing, or may be maintainedseparately. In some embodiments, each suspicious electronic file orgroup of electronic files may be displayed to a user as they aredetermined. Depending on the listings, a determination may be made toreevaluate the electronic files at block 355. This determination ofwhether to reevaluate may be made by the system evaluating the files ora user. If the electronic files are not determined to be reevaluated,this may conclude the process. If the electronic files are to bereevaluated, the process may return to block 315 to group the electronicfiles according to the same or a different threshold monetary value.

In some embodiments, an electronic file may be evaluated for membershipin more than one subgroup. An electronic file may be permitted to be amember of up to a certain number of subgroups, of particular subgroups,or of all the subgroups. For example, if an electronic file meets thecriteria at block 320 to be a member of the first subgroup and is made amember of the first subgroup at block 340-1, it may still be evaluatedto determine whether it qualifies to be member of the second subgroup atblock 330 (as depicted by decision arrow 327). Similarly, if anelectronic file is made a member of the second subgroup at block 330, itmay still be evaluated at block 335 (as depicted by decision arrow 333)for membership in the third subgroup. Therefore, if an electronic fileis made a member of more than one subgroup, the electronic file may beanalyzed according to multiple sets of selection criteria at multipleblocks, such as blocks 345-1 and 345-2. Accordingly, if the electronicfile meets the selection criteria at either of blocks 345-1 or 345-2, itmay added to a listing of candidate electronic file at blocks 350-1 and350-2. If the electronic file qualifies to be added to both listings,the electronic file may be listed multiple times or once.

Further, if an electronic file is permitted to be a member of more thanone subgroup, specific subgroups may still be excluded from evaluationdepending on previous evaluation steps. For example, if an electronicfile is determined to be a member of one or more of the first threesubgroups at blocks 325, 330, and 335, it may not be considered formembership of the fourth subgroup. Such an arrangement may prevent an“overflow” subgroup from containing electronic files that have beenadded to other subgroups.

Whether or not electronic files are evaluated for membership inexclusively one subgroup or multiple subgroups, the listing(s) ofcandidate electronic file(s) may be presented to a user for furtherinvestigation. This listing, or multiple listings, may or may not revealwhat criteria an electronic file or group of electronic files exhibitedthat qualified the files to be added to the listing of candidateelectronic files. Not including this information may have benefits. Forexample, if a user is aware as to what subgroup (or subgroups) acandidate electronic file was made a member of, she may be biased to aparticular verdict on whether the candidate electronic file was or wasnot part of suspicious, illegal, or illicit activity. In some otherembodiments, the criteria by what an electronic file was added to alisting of candidate electronic files at block 350 may be included forreasons such as speeding the user's decision making process.

FIG. 4 illustrates a simplified block diagram of another embodiment of aprocess 400 for analyzing and/or processing electronic files containingnegotiable instruments for illegal, illicit, or suspicious activityincorporating an exemplary set of evaluation and selection criteria.Process 400 of FIG. 4, may be implemented using server 230 of FIG. 2, ormay be implemented using some other computer system.

At block 410, electronic files may be grouped and sorted according to athreshold monetary value. Therefore, electronic files that contain thenegotiable instrument at or above the threshold monetary value may besorted into one group, while those below the threshold monetary valuemay be sorted into another group, at block 415. As the thresholdmonetary value is increased, a decrease in the number of electronicfiles in the group of electronic files exceeding the threshold monetaryvalue may be noted. Therefore, if it is desirable to evaluate onlyelectronic files containing negotiable instruments having a relativelyhigh value, fewer electronic files may need to be evaluated. Forexample, the threshold monetary value may be $1000.

The group of electronic files containing negotiable instruments at orabove the threshold monetary value may then be grouped by originationdata at block 420. This origination data may include the return locationrouting number. This return location routing number is a value presentin one of the data fields (record 26, field 3) of X9.37 electronicfiles. If this data field is not available, additional grouping by thebank of first deposit data field (record 25, field 11) may be done. Thisgrouping may help to separate electronic files that contain the sameaccount number or sequence number, but are associated with unrelatedbanks of first deposit. For example, person 1 may have an account atCHASE BANK numbered #2727 and person 2 may have an account at WELLSFARGO numbered #2727. A comparison of only the account numbers mayincorrectly assume these two accounts are the same account.

Following the electronic files being grouped by a return locationrouting number at block 315, the electronic files may be evaluatedand/or analyzed to determine which subgroup each electronic file belongsto. Process 400 contains five subgroups which electronic files may beclassified into. The general flow of process 400 of FIG. 4 may proceedsimilarly to process 300 of FIG. 3.

At block 425, after the group of electronic files above the thresholdmonetary value have been grouped according to origination data, theelectronic files may be evaluated to determine whether each electronicfile should be a member of the first subgroup at block 440-1. Thecriteria may be based on the deposit account number at the bank of firstdeposit data field (record 26, field 6) contained in the X9.37 file. Byevaluating the deposit account number at the bank of first deposit, itmay be determined what account at the bank of first deposit the fundswere deposited into. Therefore, electronic files that have anyidentifier present in the deposit account number at the bank of firstdeposit data fields are made a member of the first subgroup at block440-1.

At block 430, the electronic files that were not made a member of thefirst subgroup at block 425, are evaluated to determine whether eachelectronic files should be made a member of the second subgroup at block440-2. The criteria may be based on whether an electronic file has datain the bank of first deposit sequence number data field (record 26,field 5).

At block 435, the electronic files that were not made a member of thesecond subgroup at block 430, are evaluated to determine whether eachelectronic file should be made a member of the third subgroup at block440-3. The criteria for the third subgroup may be electronic files thatcontain a record 26, but do not have a deposit account number at thebank of first deposit (record 26, field 5) or a bank of first deposititem sequence number (record 26, field 6). The third subgroup may useadditional criteria, such as electronic files that have no data inrecord 26, but do have a “bank of first deposit indicator” (record 25,field 11).

At block 437, the electronic files that were not made a member of thethird subgroup at block 435 are evaluated to determine whether eachelectronic file should be made a member of the fourth subgroup at block440-4. The criteria for the fourth subgroup may be electronic files thathave a “check detail addendum C record number” (record 28, field 2) setto “01.” Another criteria for the fourth subgroup may be that dataregarding an “endorsing bank routing number” (record 28, field 3) bepresent.

The remaining electronic files, that is, the electronic files that werenot made a member of the first subgroup, the second subgroup, the thirdsubgroup, or the fourth subgroup are made a member of the fifth subgroupat block 440-5. In many instances, not enough information may be presentto determine if an illegal or suspicious activity has occurred involvingelectronic files in this group. Few electronic files may be members ofthe fifth subgroup.

Therefore, at this point, each electronic file that was groupedaccording to origination data at block 420, has now been made a memberof one subgroup. The members of each subgroup are now analyzed accordingto selection criteria specific to each subgroup to determine whetherelectronic files should be added to a listing of candidate electronicfiles for suspicious activity to be further investigated.

Therefore, at block 445-1 each electronic file that is a member of thefirst subgroup may be analyzed according to a first set of selectioncriteria. Electronic files, or groups of electronic files that meet thefirst selection criteria may be used to produce a listing of candidateelectronic files for suspicious activity at block 450-1. The first setof selection criteria may evaluate the amount of monetary fundsdeposited in individual accounts at the bank of first deposit. A totalmonetary amount deposited into a particular account within a day, orsome other predetermined amount of time may warrant furtherinvestigation. It may not matter whether this total monetary amount ismet or exceeded by one negotiable instrument, or a series of negotiableinstruments, as long as the value of the negotiable instrument isdeposited into the same account at the bank of first deposit.

As an example, consider one money order for $10,000 deposited into afirst account at bank 1 and 10 money orders each for $1000 deposited ina second account at bank 2. Because the total amount deposited into eachaccount exceeds the threshold amount, the money order for $10,000 andthe group of 10 money orders for $1000 each may require furtherinvestigation, and may be listed as a candidate for suspicious activityat block 450-1.

At block 445-2, each electronic file that is a member of the secondsubgroup may be analyzed according to a second set of selectioncriteria. This criteria may be applied to create groups of electronicfiles that are sequential according to the bank of first depositsequence number data field in groups of $5000 or greater. Theseelectronic files may be re-sequenced to include electronic files thatwere grouped separately at block 415. Further detail of this step isprovided in FIG. 5 and its associated description. After inclusion ofthose electronic files below the threshold grouped at block 415, theelectronic files of modified subgroup 2 may be again examined forsequential groups of negotiable instruments that are individually overthe threshold evaluated at block 410, and form groups greater than$5000. These sequential groups of negotiable instruments may be listedas candidates for suspicious activity at block 450-2.

At block 445-3, each electronic file that is a member of the thirdsubgroup may be analyzed according to a third set of selection criteria.The selection criteria for the third subgroup may use the “ECEInstitution items sequence number” data field (record 25, field 7) toselect sequential electronic files in groups of $5000 or greater.Electronic files, or groups of electronic files that meet the thirdselection criteria may be used to produce a listing of candidateelectronic files for suspicious activity at block 450-3.

At block 445-4, each electronic file that is a member of the fourthsubgroup may be analyzed according to a fourth set of selectioncriteria. The selection criteria for the fourth subgroup may use the“Endorsing bank sequence number” data field (record 28, field 5) toselect sequential electronic files in groups of $5000 or greater.Electronic files, or groups of electronic files that meet the fourthselection criteria may be used to produce a listing of candidateelectronic files for suspicious activity at block 450-4.

At block 445-5, each electronic file that is a member of the fifthsubgroup may be analyzed according to a fifth set of selection criteria.Each member of the fifth subgroup may have limited information availableregarding the negotiable instrument, otherwise these negotiableinstruments may have been made members of the first, second, third, orfourth subgroups. Due to limited information being available analysismay not be performed according to fifth set of selection criteria atblock 445-4. As a result, none, some, or all members of the fifthsubgroup may be used to produce a listing of candidate electronic filesfor further investigation at block 450-5.

The listings of candidate electronic files for suspicious, illegal, orillicit activity at blocks 450-1, 450-2, 450-3, 450-4, and 450-5 may beseparate listings or may be one combined listing. These listings orlisting may then be forwarded to a user for review at block 460 via auser computer, such as that illustrated in FIG. 2, or may be forwardedto law enforcement.

Following the listings or listing being presented to a user, theelectronic files may be reevaluated at block 455. If reevaluation, asdetermined either by the system according to predetermined criteria, oras determined by the user, is unnecessary, the process may conclude.Otherwise, the reevaluation process may return to block 410 and repeatthe analysis.

Analysis according to sets of selection criteria may involve alsoevaluating electronic files that were below the threshold monetary valueas groups at block 415, such as in subgroup 2 of FIG. 4. FIG. 5illustrates a process 500 that may be a part of a process, such asprocess 400, utilizing electronic files having a monetary value belowthe thresholds as groups at block 415. For example at block 510, anelectronic file (that exceeds the threshold monetary value) may be madea member of a subgroup. This group may then be evaluated according toits associated selection criteria, at block 520. It may then benecessary to incorporate electronic files that were initially excludedbecause they were below the threshold monetary value at block 530. Thismay be because the sequence in which the negotiable instruments weresubmitted to the bank of first deposit needs to be analyzed.

Following the introduction of electronic files below the thresholdmonetary value, the electronic files, including those both above andbelow the threshold monetary value, may be evaluated according toselection criteria at block 540. The selection criteria may be the sameselection criteria as that evaluated at block 520, or may be differentselection criteria. Following this, as in FIG. 4, a listing ofindividual candidate electronic files or groups of candidate electronicfiles for suspicious, illicit, or illegal activity may be produced atblock 550. At block 560, this listing of candidate electronic files maybe presented to a user or forwarded to law enforcement, as described indetail with regards to FIGS. 3 and 4.

It is also important to note, that as in FIG. 3 with respect to decisionarrows 327 and 333, some embodiments of methods and systems employingthe process 400 may evaluate electronic files for membership in morethan one subgroup. Therefore, as an example, if an electronic file ismade a member of the first subgroup, it may also be made a member of thesecond, third, fourth, and/or fifth subgroup, and be evaluated accordingto multiple sets of selection criteria.

It should be noted that the methods, systems, and devices discussedabove are intended merely to be examples. It must be stressed thatvarious embodiments may omit, substitute, or add various procedures orcomponents as appropriate. For instance, it should be appreciated that,in alternative embodiments, the methods may be performed in an orderdifferent from that described, and that various steps may be added,omitted, or combined. Also, features described with respect to certainembodiments may be combined in various other embodiments. Differentaspects and elements of the embodiments may be combined in a similarmanner. Also, it should be emphasized that technology evolves and, thus,many of the elements are examples and should not be interpreted to limitthe scope of the invention.

Specific details are given in the description to provide a thoroughunderstanding of the embodiments. However, it will be understood by oneof ordinary skill in the art that the embodiments may be practicedwithout these specific details. For example, well-known circuits,processes, algorithms, structures, and techniques have been shownwithout unnecessary detail in order to avoid obscuring the embodiments.This description provides example embodiments only, and is not intendedto limit the scope, applicability, or configuration of the invention.Rather, the preceding description of the embodiments will provide thoseskilled in the art with an enabling description for implementingembodiments of the invention. Various changes may be made in thefunction and arrangement of elements without departing from the spiritand scope of the invention.

Also, it is noted that the embodiments may be described as a processwhich is depicted as a flow diagram or block diagram. Although each maydescribe the operations as a sequential process, many of the operationscan be performed in parallel or concurrently. In addition, the order ofthe operations may be rearranged. A process may have additional stepsnot included in the figures. Furthermore, embodiments of the methods maybe implemented by hardware, software, firmware, middleware, microcode,hardware description languages, or any combination thereof. Whenimplemented in software, firmware, middleware, or microcode, the programcode or code segments to perform the necessary tasks may be stored in acomputer-readable medium such as a storage medium. Processors mayperform the necessary tasks.

Having described several embodiments, it will be recognized by those ofskill in the art that various modifications, alternative constructions,and equivalents may be used without departing from the spirit of theinvention. For example, the above elements may merely be a component ofa larger system, wherein other rules may take precedence over orotherwise modify the application of the invention. Also, a number ofsteps may be undertaken before, during, or after the above elements areconsidered. Accordingly, the above description should not be taken aslimiting the scope of the invention.

1. A method for analyzing electronic images of negotiable instruments,the method comprising: receiving, by a computer system, a plurality ofelectronic files, wherein: each electronic file of the plurality ofelectronic files comprises an image of a negotiable instrument, and eachelectronic file of the plurality of electronic files includes aplurality of data fields; identifying, by the computer system, a firstgroup of electronic files selected from the plurality of electronicfiles, wherein each of the electronic files in the first groupcorresponds to a negotiable instrument that exceeds a threshold monetaryvalue; sorting, by the computer system, the electronic files of thefirst group of electronic files into a plurality of subgroups, whereineach electronic file of the first group of electronic files is sortedinto at least one subgroup; and identifying, by the computer system,candidates for further analysis from each subgroup of electronic filesaccording to selection criteria, wherein the selection criteria appliedto each subgroup vary.
 2. The method of claim 1 for analyzing electronicimages of negotiable instruments, wherein the first subgroup is sortedbased on return location routing numbers.
 3. The method of claim 1 foranalyzing electronic images of negotiable instruments, wherein the firstsubgroup is sorted based on deposit account numbers at banks of firstdeposit.
 4. The method of claim 1 for analyzing electronic images ofnegotiable instruments, wherein the selection criteria applied to afirst subgroup of the plurality of subgroups uses a total monetaryamount of monetary value deposited in a particular deposit account. 5.The method of claim 4 for analyzing electronic images of negotiableinstruments, wherein sorting the first group of electronic files intothe plurality of subgroups includes determining whether each electronicfile of the first group is a member of the first subgroup prior todetermine whether each electronic file of the first group is a member ofa second subgroup.
 6. The method of claim 1 for analyzing electronicimages of negotiable instruments, wherein a subgroup of the plurality ofsubgroups is used for electronic files that were not sorted into anyother subgroup of the plurality of subgroups, thereby functioning as anoverflow subgroup.
 7. The method of claim 1 for analyzing electronicimages of negotiable instruments, wherein the negotiable instrument is acheck.
 8. The method of claim 1 for analyzing electronic images ofnegotiable instruments, wherein the negotiable instrument is a moneyorder.
 9. The method of claim 2 for analyzing electronic images ofnegotiable instruments, wherein the plurality of electronic files are inX9.37 format.
 10. A computer program product residing on anon-transitory processor-readable medium for analyzing electronic imagesof negotiable instruments, the computer program product comprisingprocessor-readable instructions configured to cause a processor to:identify a first group of electronic files selected from a plurality ofelectronic files, wherein each of the electronic files in the firstgroup corresponds to a negotiable instrument that exceeds a thresholdmonetary value, wherein: each electronic file of the plurality ofelectronic files comprises an image of a negotiable instrument, and eachelectronic file of the plurality of electronic files includes aplurality of data fields; sort the electronic files of the first groupof electronic files into a plurality of subgroups, wherein eachelectronic file of the first group of electronic files is sorted into atleast one subgroup; and identify candidates for further analysis fromeach subgroup of electronic files according to selection criteria,wherein the selection criteria applied to each subgroup vary.
 11. Thecomputer program product of claim 10 for analyzing electronic images ofnegotiable instruments, wherein the first subgroup is sorted based on areturn location routing number.
 12. The computer program product ofclaim 10 for analyzing electronic images of negotiable instruments,wherein the first subgroup is sorted based on deposit account numbers atbanks of first deposit.
 13. The computer program product of claim 10 foranalyzing electronic images of negotiable instruments, wherein theselection criteria applied to a first subgroup of the plurality ofsubgroups uses a total monetary amount of monetary value deposited in aparticular deposit account.
 14. The computer program product of claim 13for analyzing electronic images of negotiable instruments, whereinsorting the first group of electronic files into the plurality ofsubgroups includes determining whether each electronic file of the firstgroup is a member of the first subgroup prior to determining whethereach electronic file of the first group is a member of a secondsubgroup.
 15. The computer program product of claim 10 for analyzingelectronic images of negotiable instruments, wherein a subgroup of theplurality of subgroups is used for electronic files that were not sortedinto any other subgroup of the plurality of subgroups, therebyfunctioning as an overflow subgroup.
 16. The computer program product ofclaim 10 for analyzing electronic images of negotiable instruments,wherein the negotiable instrument is a check.
 17. The computer programproduct of claim 10 for analyzing electronic images of negotiableinstruments, wherein the negotiable instrument is a money order.
 18. Thecomputer program product of claim 10 for analyzing electronic images ofnegotiable instruments, wherein the plurality of electronic files are inX9.37 format.
 19. A system for analyzing electronic images of negotiableinstruments, the system comprising: a processor; and a memorycommunicatively coupled with and readable by the processor and havingstored therein processor-readable instructions which, when executed bythe processor, cause the processor to: identify a first group ofelectronic files selected from a plurality of electronic files, whereineach of the electronic files in the first group corresponds to anegotiable instrument that exceeds a threshold monetary value, wherein:each electronic file of the plurality of electronic files comprises anelectronic image of a negotiable instrument, and each electronic file ofthe plurality of electronic files includes a plurality of data fields;sort the electronic files of the first group of electronic files into aplurality of subgroups, wherein each electronic file of the first groupof electronic files is sorted into at least one subgroup; and identifycandidates for further analysis from each subgroup of electronic filesaccording to selection criteria, wherein the selection criteria appliedto each subgroup vary.
 20. The system of claim 19 for analyzingelectronic images of negotiable instruments, wherein the first subgroupis sorted based on deposit account numbers at banks of first deposit.